The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - bpf: Fix reference count leak in bpf_prog_test_run_xdp() syzbot is reporting unregister_netdevice: waiting     for sit0 to become free. Usage count = 2 problem. A debug printk() patch found that a refcount is obtained     at xdp_convert_md_to_buff() from bpf_prog_test_run_xdp(). According to commit ec94670fcb3b (bpf: Support     specifying ingress via xdp_md context in BPF_PROG_TEST_RUN), the refcount obtained by     xdp_convert_md_to_buff() will be released by xdp_convert_buff_to_md(). Therefore, we can consider that the     error handling path introduced by commit 1c1949982524 (bpf: introduce frags support to     bpf_prog_test_run_xdp()) forgot to call xdp_convert_buff_to_md(). (CVE-2026-22994)

Note that Nessus relies on the presence of the package as reported by the vendor.

Detections

Analytics

Linux Distros Unpatched Vulnerability : CVE-2026-22994

high Nessus Plugin ID 296411

Version 1.9

Version 1.8

Version 1.6

Version 1.5

Version 1.4

Version 1.3

Version 1.2

Version 1.1

Version 1.9 Feb 14, 2026, 1:12 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202602140112
Version 1.8 Feb 12, 2026, 7:05 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202602120705
Version 1.6 Feb 10, 2026, 11:15 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202602101115
Version 1.5 Feb 7, 2026, 9:06 AM Detection (updated detection logic) Plugin metadata Plugin Feed: 202602070906
Version 1.4 Feb 5, 2026, 2:38 AM Detection (updated detection logic) Plugin Feed: 202602050238
Version 1.3 Jan 31, 2026, 11:07 AM CVSS metrics ("CVSSv2 score" set to 5.6) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:C") CVSSv2 severity (based on CVE-2026-22994, severity increased from "Low" to "Medium") Detection (updated detection logic) Plugin metadata Plugin Feed: 202601311107
Version 1.2 Jan 24, 2026, 9:30 PM CVSS metrics ("CVSSv2 score" set to 2.1) CVSS metrics ("CVSSv2 vector" set to "CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N") CVSS metrics ("CVSSv3 score" set to 7.1) CVSS metrics ("CVSSv3 vector" set to "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H") CVSSv2 severity (based on CVE-2026-22994, severity decreased from "High" to "Low") Detection (updated detection logic) Plugin metadata Plugin Feed: 202601242130
Version 1.1 Jan 23, 2026, 11:44 PM New Plugin Feed: 202601232344